In May last year, Google quietly launched a tool called “store sales measurement” that could help it determine whether an online ad led directly to real-world purchases. The tech giant didn’t explain exactly how this new tracking system worked, but assured advertisers that it would provide them with valuable insight into the link between what people look at online and what they buy offline.

On Thursday, Bloombergreported that what underpins Google's ad tracking tool is enormous amounts of MasterCard transaction data, which it secretly bought off the credit card company for millions of dollars. This deal was reached without consulting MasterCard customers whose purchase history was sold to Google without their explicit consent.

The way Google’s ad-tracking tool works is like this: If you are online and click on an ad for, say, a backpack, but don’t purchase it, but then later walk into a shop and buy that same backpack, Google will know. This allows Google to measure the impact of online advertising on real world purchasing behavior. This type of data is incredibly valuable for advertising agencies, and the tool has already been a boon for Google, leading to increased ad sales.

Google and MasterCard have both defended the hushed-up deal by clarifying that the ad-tracking tool uses “double-blind encryption,” meaning that neither party can access or view any identifiable information on the purchasers. “No individual transaction or personal data is provided,” MasterCard spokesperson Seth Eisen said in a statement. “We do not provide insights that track, serve up ads to, or even measure ad effectiveness relating to, individual consumers.”

Google, which is the world’s biggest advertising company, has also confirmed that users can opt out by changing their settings in “Web and App Activity”. But Christine Bannan of the Electronic Privacy Information Centre told Bloomberg that this burden shouldn’t rest on unwitting consumers. "People don’t expect what they buy physically in a store to be linked to what they are buying online,” she said. "There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.”